Question 1

Which of the following global privacy legislation principles ensures that data handling policies and the name of the data controller are easily accessible to the public?

Accepted Answer

The principle of openness ensures that data handling policies and the identity of the data controller are transparent and accessible to the public.

Question 2

A company has decided that they need to begin maintaining assets deployed in the enterprise. What approach should be followed to determine and maintain ownership information to bring the company into compliance?

Accepted Answer

An enterprise asset management framework provides a structured approach to managing and maintaining assets, including tracking ownership information, ensuring compliance, and optimizing asset utilization.

Question 3

Which of the following initiates the systems recovery phase of a Disaster Recovery Plan (DRP)?

Accepted Answer

The answer of Which of the following initiates the systems...

Question 4

What is the MOST important element when considering the effectiveness of a training program for Business Continuity (BC) and Disaster Recovery (DR)?

Accepted Answer

The answer of What is the MOST important element when...

Question 5

The personal laptop of an organization executive is stolen from the office, complete with personnel and project records. Which of the following should be done FIRST to mitigate future occurrences?

Accepted Answer

The answer of The personal laptop of an organization executive...

Question 6

What is the purpose of code signing?

Accepted Answer

Code signing is primarily used to verify the authenticity and integrity of the software, ensuring it was not altered and originated from the signer. It does not guarantee the software is free of malicious code.

Question 7

Which of the following is a peer entity authentication method for Point-to-Point Protocol (PPP)?

Accepted Answer

CHAP (Challenge Handshake Authentication Protocol) is specifically designed for peer entity authentication in PPP.

Question 8

What is the FIRST action a security professional needs to take while assessing an organization's asset security in order to properly classify and protect access to data?

Accepted Answer

The answer of What is the FIRST action a security...

Question 9

Which testing method requires very limited or no information about the network infrastructure?

Accepted Answer

Black box testing requires very limited or no information about the network infrastructure, as it focuses on testing the system from an external perspective without knowledge of the internal workings.

Question 10

Which of the following is the FIRST thing to consider when reviewing Information Technology (IT) internal controls?

Accepted Answer

The answer of Which of the following is the FIRST...

Question 11

Which of the following is the PRIMARY risk with using open source software in a commercial software construction?

Accepted Answer

The answer of Which of the following is the PRIMARY...

Question 12

What is the MAIN reason for having a developer sign a Non-Disclosure Agreement (NDA)?

Accepted Answer

The main reason for having a developer sign an NDA is to protect confidential information, technical details, or intellectual property from being disclosed to unauthorized parties.

Question 13

Who is responsible for the protection of information when it is shared with or provided to other organizations?

Accepted Answer

The information owner is responsible for the protection of information when it is shared with or provided to other organizations, as they have the authority and responsibility for the data.

Question 14

Point-to-Point Protocol (PPP) was designed to specifically address what issue?

Accepted Answer

PPP was designed to improve speed and reliability for dial-up users connecting to ISPs, providing a standard method for transporting multi-protocol datagrams over point-to-point links.

Question 15

The application of a security patch to a product previously validate at Common Criteria (CC) Evaluation Assurance Level (EAL) 4 would

Accepted Answer

Applying a security patch to a product that has been validated at a specific EAL level typically requires recertification to ensure that the patch does not introduce new vulnerabilities or affect the security assurances provided by the original evaluation.

Question 16

When would an organization review a Business Continuity Management (BCM) system?

Accepted Answer

The answer of When would an organization review a Business...

Question 17

Which of the following is a security weakness in the evaluation of Common Criteria (CC) products?

Accepted Answer

Allowing the manufacturer to state the configuration for evaluation can lead to a security weakness, as they might choose a configuration that is not representative of real-world use, potentially overlooking vulnerabilities.

Question 18

During a Disaster Recovery (DR) simulation, it is discovered that the shared recovery site lacks adequate data restoration capabilities to support the implementation of multiple plans simultaneously. What would be impacted by this fact if left unchanged?

Accepted Answer

The Recovery Time Objective (RTO) would be impacted because inadequate data restoration capabilities would delay the time it takes to recover systems and resume operations.

Question 19

Which of the following will accomplish Multi-Factor Authentication (MFA)?

Accepted Answer

The answer of Which of the following will accomplish Multi-Factor...

Question 20

From a cryptographic perspective, the service of non-repudiation includes which of the following features?

Accepted Answer

The answer of From a cryptographic perspective, the service of...

Exam 3: Certified Information Systems Security Professional